Introduction
Attackers can poison DNS caches on vulnerable BIND 9 servers by predicting the source port and query ID used for outgoing queries. Those two values are the primary defense against DNS spoofing, so predicting them exposes organizations to redirection, credential theft, and service disruption. BIND 9 is a widely deployed DNS server maintained by the Internet Systems Consortium (ISC), and ISPs, enterprises, and public DNS providers run it around the world. Because of that reach, its security bears directly on internet reliability and trust.
Technical Information
CVE-2025-40780 is a vulnerability in the pseudo random number generator (PRNG) that BIND 9 uses to pick the source port and query ID for outgoing DNS queries. These two values are the core entropy sources that protect DNS resolvers from cache poisoning. Under certain operational circumstances, the PRNG produces values an attacker can predict. An attacker who can observe or infer the PRNG state or output can anticipate the next source port and query ID BIND will use for a query. The attacker can then forge DNS responses that match those parameters, and the resolver will accept and cache them.
The issue is classified as CWE-341 (Predictable from Observable State). The root cause is either insufficient entropy or a PRNG design whose output can be predicted from observable state. No public code snippets or detailed code-level advisories are available. In effect, the entropy behind DNS query validation is reduced or eliminated, which makes cache poisoning feasible with a practical number of forged responses.
Affected Systems and Versions
The following BIND 9 versions are affected:
- 9.16.0 through 9.16.50
- 9.18.0 through 9.18.39
- 9.20.0 through 9.20.13
- 9.21.0 through 9.21.12
- 9.16.8-S1 through 9.16.50-S1 (Supported Preview Edition)
- 9.18.11-S1 through 9.18.39-S1 (Supported Preview Edition)
- 9.20.9-S1 through 9.20.13-S1 (Supported Preview Edition)
Any BIND 9 resolver configured to use the affected PRNG implementation is vulnerable. There is no indication that authoritative-only configurations are affected, but treat every recursive and forwarding resolver deployment in these version ranges as at risk.
Vendor Security History
BIND 9 has a long history of security research and vulnerability disclosures. Earlier high-profile issues include cache poisoning (the Kaminsky bug), denial of service via malformed DNS packets, and protocol implementation flaws. ISC typically responds quickly with advisories and patches, and its advisories are detailed and actionable. The vendor is considered mature in how it handles vulnerabilities.
